Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 88f6276ed5d58c64…

MALICIOUS

Office (OLE)

336.0 KB Created: 2003-03-19 05:17:53 Authoring application: WPS Office
MD5: 17eb976348231c428941e93c365a0a6b SHA-1: d6540659863591a5b04fbb2e6b67bae6e82a0ef4 SHA-256: 88f6276ed5d58c64dcf42acc42f79d41faa41ae64621ff84defc8685801b9751
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1059.001 PowerShell

The sample contains Excel 4.0 macros, indicated by the OLE_XLM_AUTOOPEN and OLE_XLM_AUTOOPEN_DEFINEDNAME heuristics. The presence of an Auto_Open entry suggests that the macro will execute automatically when the workbook is opened. While the VBA project itself contains no executable statements, the XLM macro sheet is the primary execution vector. The SC_STR_WSCRIPT heuristic also suggests potential interaction with Windows Script Host, which could be used to launch further malicious activity.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
72ae0b9fcaa010ef8c01c8cc58c75953950fe0c15761dfc6b85fec57b9ae0d35		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 23099 bytes
macros.bas
c1d90dd1bc2c1cebc46684b9ade2b5d1502584e615fff9b78c7cf143eb6aa943		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 306 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.